v1.0.0-beta.5

The fifth beta of Lakka: a self-hosted AI control plane for teams of 10 to 50 people, with one install, your own model keys, and one identity and policy model applied across web chat, an OpenAI-compatible API and MCP. Spend cannot exceed a cap, every request is attributed and traced, and a tool can never do what the requesting user is not allowed to do.

This is a beta. Everything v1 set out to do is built, and every check passes on amd64 and arm64. Report what you find through the issue forms; report a security problem privately, as SECURITY.md describes, never in a public issue.

What changed since v1.0.0-beta.4

• A security fix in the web app (#11): CVE-2026-102989, an unauthenticated reflected XSS in TanStack Start's server-function responses, rated critical. v1.0.0-beta.4 ships the affected @tanstack/start-server-core 1.169.37, and its web app answers through a server function. This release has the fixed 1.169.39, with @tanstack/react-start 1.168.60 and @tanstack/react-router 1.170.41. Upgrade from v1.0.0-beta.4. Better Auth's optional TanStack Start dependency, which nothing in Lakka uses and which would have kept the old version in the image, is no longer installed.
• The guide says your team does not have to use Lakka's chat (#10): any app, coding harness or script that speaks the OpenAI Chat Completions API can use Lakka with a Lakka key, with the same caps, traces, permissions and routing as chat, and the model auto lets the workspace's routes choose. The README, the landing page, the guide's first page, install, administration, the tour and the example routes now say so. The API says which apps are tested on every change (Open WebUI, LibreChat and the official OpenAI SDKs), what an untested app must not need, and how a request that names no conversation is routed: on its latest user message, so a new message can go to another route's model. Lakka itself works as before; only the docs changed.
• A steadier site check for contributors (#12): the project site's search test waits up to 15 seconds for result excerpts, which Linux WebKit on CI once took longer than the default 5 seconds to render.

There are no database migrations and no changes to configuration, HTTP headers or the API.

Install

You need Docker Engine 26 or later (Docker Desktop 4.29 or later) with Compose v2.20 or later, on amd64 or arm64.

1. Download lakka-v1.0.0-beta.5.tar.gz and its .sha256 and .sigstore.json from the assets below.

2. Check them. With cosign installed:

   sha256sum -c lakka-v1.0.0-beta.5.tar.gz.sha256
   cosign verify-blob lakka-v1.0.0-beta.5.tar.gz \
     --bundle lakka-v1.0.0-beta.5.tar.gz.sigstore.json \
     --certificate-identity 'https://github.com/lakka-ai/lakka/.github/workflows/release.yml@refs/tags/v1.0.0-beta.5' \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com
   

   sha256sum is shasum -a 256 on a Mac.

3. Unpack it and start it:

   tar -xzf lakka-v1.0.0-beta.5.tar.gz && cd lakka-v1.0.0-beta.5
   docker compose up -d --wait
   

4. Open http://localhost:8080 and follow the setup. The setup code comes from docker compose exec api lakka setup-code.

The guide covers the rest: serving it on a domain with HTTPS, administration, the API, every setting, backups, upgrades and troubleshooting. A tour of Lakka shows what it looks like in use.

What is in it

• Identity: local accounts and OIDC sign-in, workspaces, invites by link, and API keys that act as a person and can never do more than that person.
• Models: a gateway over Anthropic, OpenAI, Google and OpenAI-compatible providers, with failover before the first byte of a reply and cost recorded in integer micro-USD. An optional signed price feed, off by default, brings new prices between releases.
• Budgets: caps for the instance, each workspace, each member and each key, reserved before every request and refused when they cannot be checked; a per-person rate limit; alerts over signed webhooks.
• Routing: an in-process classifier picks a model by task, in English, German, French, Spanish and Swedish. In chat, and in an API request that names a conversation, it decides once for the conversation; any other app that asks the API for the model auto is routed on each request. It is optional everywhere, and a larger model can be chosen for other languages.
• Tools: MCP servers with per-person OAuth, allowlists, approvals and a full audit. Command-line servers run in a sandbox whose only network is an egress proxy.
• Operations: a trace for every request, opt-in content capture, retention, OTLP export, export and deletion of a person's data, a diagnostics bundle with no secrets in it, backup and restore, and rotation of the credential master key.
• No telemetry: nothing leaves the instance unless an admin turns that connection on.

Images

ghcr.io/lakka-ai/lakka:v1.0.0-beta.5 and ghcr.io/lakka-ai/lakka-caddy:v1.0.0-beta.5, for amd64 and arm64, signed keylessly with Sigstore and with build provenance attached. As a prerelease they are not tagged latest. The bundle names them by digest. To check one:

cosign verify ghcr.io/lakka-ai/lakka@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/lakka-ai/lakka/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limits

• Serving Lakka under a subpath, such as example.com/lakka/, is not supported, and neither is HTTPS with Caddy's internal certificates (tls internal).
• Under rootless Docker or userns-remap, the sandbox's users (uids 61000 to 61063) must be inside the mapped range; if they are not, the sandbox never becomes healthy. The troubleshooting guide says what to do.
• The OAuth callback for a tool server returns to the public URL, so reach the instance at that address, not another one such as 127.0.0.1 for localhost.
• The backup file is not encrypted and holds every secret, the credential master key included. Keep it as safe as the server.
• Attachments are stored in the database, so backups grow with them.
• Classification takes under 100 ms on 2 CPUs with the default model. The larger, optional model is held to 200 ms.
• The provider Check tests a provider's key and address, not its account's credit or the model ids added for it.

Upgrading

From v1.0.0-beta.4, upgrade in place, on the same volumes, as the upgrade guide describes: back up, unpack the new bundle over the current directory with tar -xzf lakka-v1.0.0-beta.5.tar.gz --strip-components=1, then docker compose up -d --wait. Nothing needs doing before or after. The upgrade path from the previous release is tested on every change.

The configuration names, HTTP headers and API this release ships are meant to be the ones v1.0.0 ships. All three are unchanged since v1.0.0-beta.4.

License

AGPL-3.0-only. Contributions are signed off under the Developer Certificate of Origin, with no contributor license agreement; see CONTRIBUTING.md.

Full changelog: v1.0.0-beta.4...v1.0.0-beta.5

v1.0.0-beta.4

The fourth beta of Lakka: a self-hosted AI control plane for teams of 10 to 50 people, with one install, your own model keys, and one identity and policy model applied across web chat, an OpenAI-compatible API and MCP. Spend cannot exceed a cap, every request is attributed and traced, and a tool can never do what the requesting user is not allowed to do.

This is a beta. Everything v1 set out to do is built, and every check passes on amd64 and arm64. Report what you find through the issue forms; report a security problem privately, as SECURITY.md describes, never in a public issue.

What changed since v1.0.0-beta.3

• Three fixes in chat and request traces (#8):
  • Code in a message you wrote, with a line wider than the message, spilled out past the message's left edge instead of scrolling. On a phone it ran off the screen. It now scrolls sideways inside the message (CH-1).
  • A tool call waiting for your approval was listed as "Used" above the approval card, as if it had run. It had not. It is no longer listed while it waits, or after it expires because you sent something else; a call that ran after you allowed it is listed as before (TL-4).
  • The trace of a request refused at the budget left the model out of its budget step, which read "could cost up to ..." with no name. It now names the model routing picked (OB-1).
• A tour of Lakka (#8): a new guide page, A tour of Lakka, shows the web app in use, in light and dark: sign-in, model keys, people, routing, caps that hold, the move to a cheaper model at a cap (also as a short video), request traces, spend, and tools that ask first. The screenshots come from a demo install, and the page says what the demo fakes. The README now opens with one of them.
• Link previews for the project site (#8): every page of the site carries Open Graph and Twitter card tags with its own title, summary and address, and a preview image, so a shared link shows a card.
• A demo instance for contributors (#8): pnpm demo:seed and pnpm demo:capture set up the demo and remake the tour's screenshots after a change to the web app (ADR 0128). They are development tools and are not in the images.

There are no database migrations and no changes to configuration, HTTP headers or the API.

Install

You need Docker Engine 26 or later (Docker Desktop 4.29 or later) with Compose v2.20 or later, on amd64 or arm64.

1. Download lakka-v1.0.0-beta.4.tar.gz and its .sha256 and .sigstore.json from the assets below.

2. Check them. With cosign installed:

   sha256sum -c lakka-v1.0.0-beta.4.tar.gz.sha256
   cosign verify-blob lakka-v1.0.0-beta.4.tar.gz \
     --bundle lakka-v1.0.0-beta.4.tar.gz.sigstore.json \
     --certificate-identity 'https://github.com/lakka-ai/lakka/.github/workflows/release.yml@refs/tags/v1.0.0-beta.4' \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com
   

   sha256sum is shasum -a 256 on a Mac.

3. Unpack it and start it:

   tar -xzf lakka-v1.0.0-beta.4.tar.gz && cd lakka-v1.0.0-beta.4
   docker compose up -d --wait
   

4. Open http://localhost:8080 and follow the setup. The setup code comes from docker compose exec api lakka setup-code.

The guide covers the rest: serving it on a domain with HTTPS, administration, the API, every setting, backups, upgrades and troubleshooting. A tour of Lakka shows what it looks like in use.

What is in it

• Identity: local accounts and OIDC sign-in, workspaces, invites by link, and API keys that act as a person and can never do more than that person.
• Models: a gateway over Anthropic, OpenAI, Google and OpenAI-compatible providers, with failover before the first byte of a reply and cost recorded in integer micro-USD. An optional signed price feed, off by default, brings new prices between releases.
• Budgets: caps for the instance, each workspace, each member and each key, reserved before every request and refused when they cannot be checked; a per-person rate limit; alerts over signed webhooks.
• Routing: an in-process classifier picks a model by task, once per conversation, in English, German, French, Spanish and Swedish. It is optional everywhere, and a larger model can be chosen for other languages.
• Tools: MCP servers with per-person OAuth, allowlists, approvals and a full audit. Command-line servers run in a sandbox whose only network is an egress proxy.
• Operations: a trace for every request, opt-in content capture, retention, OTLP export, export and deletion of a person's data, a diagnostics bundle with no secrets in it, backup and restore, and rotation of the credential master key.
• No telemetry: nothing leaves the instance unless an admin turns that connection on.

Images

ghcr.io/lakka-ai/lakka:v1.0.0-beta.4 and ghcr.io/lakka-ai/lakka-caddy:v1.0.0-beta.4, for amd64 and arm64, signed keylessly with Sigstore and with build provenance attached. As a prerelease they are not tagged latest. The bundle names them by digest. To check one:

cosign verify ghcr.io/lakka-ai/lakka@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/lakka-ai/lakka/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limits

• Serving Lakka under a subpath, such as example.com/lakka/, is not supported, and neither is HTTPS with Caddy's internal certificates (tls internal).
• Under rootless Docker or userns-remap, the sandbox's users (uids 61000 to 61063) must be inside the mapped range; if they are not, the sandbox never becomes healthy. The troubleshooting guide says what to do.
• The OAuth callback for a tool server returns to the public URL, so reach the instance at that address, not another one such as 127.0.0.1 for localhost.
• The backup file is not encrypted and holds every secret, the credential master key included. Keep it as safe as the server.
• Attachments are stored in the database, so backups grow with them.
• Classification takes under 100 ms on 2 CPUs with the default model. The larger, optional model is held to 200 ms.
• The provider Check tests a provider's key and address, not its account's credit or the model ids added for it.

Upgrading

From v1.0.0-beta.3, upgrade in place, on the same volumes, as the upgrade guide describes: back up, unpack the new bundle over the current directory with tar -xzf lakka-v1.0.0-beta.4.tar.gz --strip-components=1, then docker compose up -d --wait. Nothing needs doing before or after. The upgrade path from the previous release is tested on every change.

The configuration names, HTTP headers and API this release ships are meant to be the ones v1.0.0 ships. All three are unchanged since v1.0.0-beta.3.

License

AGPL-3.0-only. Contributions are signed off under the Developer Certificate of Origin, with no contributor license agreement; see CONTRIBUTING.md.

Full changelog: v1.0.0-beta.3...v1.0.0-beta.4

v1.0.0-beta.3

The third beta of Lakka: a self-hosted AI control plane for teams of 10 to 50 people, with one install, your own model keys, and one identity and policy model applied across web chat, an OpenAI-compatible API and MCP. Spend cannot exceed a cap, every request is attributed and traced, and a tool can never do what the requesting user is not allowed to do.

This is a beta. Everything v1 set out to do is built, and every check passes on amd64 and arm64. Report what you find through the issue forms; report a security problem privately, as SECURITY.md describes, never in a public issue.

What changed since v1.0.0-beta.2

• Clear errors when a provider account is out of credit, or does not know a model id (#6). Two common mistakes when setting up a provider used to produce messages that pointed the wrong way:

  • A provider that refused for billing (HTTP 402, OpenAI's insufficient_quota, or Anthropic's "credit balance is too low") was reported as a message the provider could not handle, and chat suggested rewording it. It is now provider_billing. It is not retried or failed over, and chat names the provider and says an admin has to check its account.
  • A custom model whose id the provider does not know, with no fallback that worked, was reported as the provider not responding. It is now provider_model_not_found, and chat names the provider and the model id an admin has to correct. A model the provider does not know still fails over to the next one at once.

  Neither costs anything: nothing is charged for a refused request. The provider Check still tests only the key and address, which is why it passed in both cases; the guide now says so (CH-7, ADR 0127).

• Example routes for operators (#4): a new guide page, Example routes, has seven routes to copy (code, summaries, translation, contracts and privacy, customer replies, data, brainstorming), each with a description and example phrasings, and advice on writing your own.

• A flaky acceptance test fixed (in #6): the keyboard test for the Sign-in providers tab could press an arrow key before the page had loaded, and fail now and then. Only the test changed.

• ARCHITECTURE.md describes the code as of M10 (#5).

There are no database migrations and no changes to configuration or HTTP headers. The API gains two error codes, described under Upgrading.

Install

You need Docker Engine 26 or later (Docker Desktop 4.29 or later) with Compose v2.20 or later, on amd64 or arm64.

1. Download lakka-v1.0.0-beta.3.tar.gz and its .sha256 and .sigstore.json from the assets below.

2. Check them. With cosign installed:

   sha256sum -c lakka-v1.0.0-beta.3.tar.gz.sha256
   cosign verify-blob lakka-v1.0.0-beta.3.tar.gz \
     --bundle lakka-v1.0.0-beta.3.tar.gz.sigstore.json \
     --certificate-identity 'https://github.com/lakka-ai/lakka/.github/workflows/release.yml@refs/tags/v1.0.0-beta.3' \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com
   

   sha256sum is shasum -a 256 on a Mac.

3. Unpack it and start it:

   tar -xzf lakka-v1.0.0-beta.3.tar.gz && cd lakka-v1.0.0-beta.3
   docker compose up -d --wait
   

4. Open http://localhost:8080 and follow the setup. The setup code comes from docker compose exec api lakka setup-code.

The guide covers the rest: serving it on a domain with HTTPS, administration, the API, every setting, backups, upgrades and troubleshooting.

What is in it

• Identity: local accounts and OIDC sign-in, workspaces, invites by link, and API keys that act as a person and can never do more than that person.
• Models: a gateway over Anthropic, OpenAI, Google and OpenAI-compatible providers, with failover before the first byte of a reply and cost recorded in integer micro-USD. An optional signed price feed, off by default, brings new prices between releases.
• Budgets: caps for the instance, each workspace, each member and each key, reserved before every request and refused when they cannot be checked; a per-person rate limit; alerts over signed webhooks.
• Routing: an in-process classifier picks a model by task, once per conversation, in English, German, French, Spanish and Swedish. It is optional everywhere, and a larger model can be chosen for other languages.
• Tools: MCP servers with per-person OAuth, allowlists, approvals and a full audit. Command-line servers run in a sandbox whose only network is an egress proxy.
• Operations: a trace for every request, opt-in content capture, retention, OTLP export, export and deletion of a person's data, a diagnostics bundle with no secrets in it, backup and restore, and rotation of the credential master key.
• No telemetry: nothing leaves the instance unless an admin turns that connection on.

Images

ghcr.io/lakka-ai/lakka:v1.0.0-beta.3 and ghcr.io/lakka-ai/lakka-caddy:v1.0.0-beta.3, for amd64 and arm64, signed keylessly with Sigstore and with build provenance attached. As a prerelease they are not tagged latest. The bundle names them by digest. To check one:

cosign verify ghcr.io/lakka-ai/lakka@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/lakka-ai/lakka/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limits

• Serving Lakka under a subpath, such as example.com/lakka/, is not supported, and neither is HTTPS with Caddy's internal certificates (tls internal).
• Under rootless Docker or userns-remap, the sandbox's users (uids 61000 to 61063) must be inside the mapped range; if they are not, the sandbox never becomes healthy. The troubleshooting guide says what to do.
• The OAuth callback for a tool server returns to the public URL, so reach the instance at that address, not another one such as 127.0.0.1 for localhost.
• The backup file is not encrypted and holds every secret, the credential master key included. Keep it as safe as the server.
• Attachments are stored in the database, so backups grow with them.
• Classification takes under 100 ms on 2 CPUs with the default model. The larger, optional model is held to 200 ms.
• The provider Check tests a provider's key and address, not its account's credit or the model ids added for it.

Upgrading

From v1.0.0-beta.2, upgrade in place, on the same volumes, as the upgrade guide describes: back up, unpack the new bundle over the current directory with tar -xzf lakka-v1.0.0-beta.3.tar.gz --strip-components=1, then docker compose up -d --wait. Nothing needs doing before or after. The upgrade path from the previous release is tested on every change.

The configuration names, HTTP headers and API this release ships are meant to be the ones v1.0.0 ships. Configuration names and HTTP headers are unchanged since v1.0.0-beta.2. The API gains two error codes, both HTTP 502 with type server_error, both needing an admin to fix:

When	Before	Now
The provider refused for billing (402, or a refusal that says so)	400 provider_rejected_request; OpenAI's 429 insufficient_quota was retried, then 502 upstream_unavailable	502 provider_billing, with lakka.provider
Every model tried was one its provider does not know	502 upstream_unavailable	502 provider_model_not_found, with lakka.provider and lakka.model

HTTP 402 still means only budget_exceeded, so a client can always tell a Lakka budget from a provider's account. A client that branches on code should handle the two new codes like provider_auth_failed. The official OpenAI SDKs retry a 502 on their own, as they already do for provider_auth_failed; those retries fail the same way and cost nothing.

License

AGPL-3.0-only. Contributions are signed off under the Developer Certificate of Origin, with no contributor license agreement; see CONTRIBUTING.md.

Full changelog: v1.0.0-beta.2...v1.0.0-beta.3

v1.0.0-beta.2

The second beta of Lakka: a self-hosted AI control plane for teams of 10 to 50 people, with one install, your own model keys, and one identity and policy model applied across web chat, an OpenAI-compatible API and MCP. Spend cannot exceed a cap, every request is attributed and traced, and a tool can never do what the requesting user is not allowed to do.

This is a beta. Everything v1 set out to do is built, and every check passes on amd64 and arm64. Report what you find through the issue forms; report a security problem privately, as SECURITY.md describes, never in a public issue.

What changed since v1.0.0-beta.1

• Tool servers report their shared credential correctly (#2). In v1.0.0-beta.1 a tool server always read back as having no shared credential, even with one set. The Tools page then warned that none was set, and the edit dialog asked for the secret again on every save. Tool calls were not affected: they found and used the credential. An integration test now reads the flag back before setting, after setting and after removing the credential (TL-2).

There are no database migrations and no changes to configuration, HTTP headers or the API.

Install

You need Docker Engine 26 or later (Docker Desktop 4.29 or later) with Compose v2.20 or later, on amd64 or arm64.

1. Download lakka-v1.0.0-beta.2.tar.gz and its .sha256 and .sigstore.json from the assets below.

2. Check them. With cosign installed:

   sha256sum -c lakka-v1.0.0-beta.2.tar.gz.sha256
   cosign verify-blob lakka-v1.0.0-beta.2.tar.gz \
     --bundle lakka-v1.0.0-beta.2.tar.gz.sigstore.json \
     --certificate-identity 'https://github.com/lakka-ai/lakka/.github/workflows/release.yml@refs/tags/v1.0.0-beta.2' \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com
   

   sha256sum is shasum -a 256 on a Mac.

3. Unpack it and start it:

   tar -xzf lakka-v1.0.0-beta.2.tar.gz && cd lakka-v1.0.0-beta.2
   docker compose up -d --wait
   

4. Open http://localhost:8080 and follow the setup. The setup code comes from docker compose exec api lakka setup-code.

The guide covers the rest: serving it on a domain with HTTPS, administration, the API, every setting, backups, upgrades and troubleshooting.

What is in it

• Identity: local accounts and OIDC sign-in, workspaces, invites by link, and API keys that act as a person and can never do more than that person.
• Models: a gateway over Anthropic, OpenAI, Google and OpenAI-compatible providers, with failover before the first byte of a reply and cost recorded in integer micro-USD. An optional signed price feed, off by default, brings new prices between releases.
• Budgets: caps for the instance, each workspace, each member and each key, reserved before every request and refused when they cannot be checked; a per-person rate limit; alerts over signed webhooks.
• Routing: an in-process classifier picks a model by task, once per conversation, in English, German, French, Spanish and Swedish. It is optional everywhere, and a larger model can be chosen for other languages.
• Tools: MCP servers with per-person OAuth, allowlists, approvals and a full audit. Command-line servers run in a sandbox whose only network is an egress proxy.
• Operations: a trace for every request, opt-in content capture, retention, OTLP export, export and deletion of a person's data, a diagnostics bundle with no secrets in it, backup and restore, and rotation of the credential master key.
• No telemetry: nothing leaves the instance unless an admin turns that connection on.

Images

ghcr.io/lakka-ai/lakka:v1.0.0-beta.2 and ghcr.io/lakka-ai/lakka-caddy:v1.0.0-beta.2, for amd64 and arm64, signed keylessly with Sigstore and with build provenance attached. As a prerelease they are not tagged latest. The bundle names them by digest. To check one:

cosign verify ghcr.io/lakka-ai/lakka@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/lakka-ai/lakka/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limits

• Serving Lakka under a subpath, such as example.com/lakka/, is not supported, and neither is HTTPS with Caddy's internal certificates (tls internal).
• Under rootless Docker or userns-remap, the sandbox's users (uids 61000 to 61063) must be inside the mapped range; if they are not, the sandbox never becomes healthy. The troubleshooting guide says what to do.
• The OAuth callback for a tool server returns to the public URL, so reach the instance at that address, not another one such as 127.0.0.1 for localhost.
• The backup file is not encrypted and holds every secret, the credential master key included. Keep it as safe as the server.
• Attachments are stored in the database, so backups grow with them.
• Classification takes under 100 ms on 2 CPUs with the default model. The larger, optional model is held to 200 ms.

Upgrading

From v1.0.0-beta.1, upgrade in place, on the same volumes, as the upgrade guide describes: back up, unpack the new bundle over the current directory with tar -xzf lakka-v1.0.0-beta.2.tar.gz --strip-components=1, then docker compose up -d --wait. Nothing needs doing before or after. The upgrade path from the previous release is tested on every change.

The configuration names, HTTP headers and API this release ships are meant to be the ones v1.0.0 ships. None changed since v1.0.0-beta.1; if one changes before v1.0.0, that release's notes say so.

License

AGPL-3.0-only. Contributions are signed off under the Developer Certificate of Origin, with no contributor license agreement; see CONTRIBUTING.md.

Full changelog: v1.0.0-beta.1...v1.0.0-beta.2

v1.0.0-beta.1

The first public release of Lakka: a self-hosted AI control plane for teams of 10 to 50 people, with one install, your own model keys, and one identity and policy model applied across web chat, an OpenAI-compatible API and MCP. Spend cannot exceed a cap, every request is attributed and traced, and a tool can never do what the requesting user is not allowed to do.

This is a beta. Everything v1 set out to do is built, and every check passes on amd64 and arm64, but this is the first time it runs outside the project. Report what you find through the issue forms; report a security problem privately, as SECURITY.md describes, never in a public issue.

Install

You need Docker Engine 26 or later (Docker Desktop 4.29 or later) with Compose v2.20 or later, on amd64 or arm64.

1. Download lakka-v1.0.0-beta.1.tar.gz and its .sha256 and .sigstore.json from the assets below.

2. Check them. With cosign installed:

   sha256sum -c lakka-v1.0.0-beta.1.tar.gz.sha256
   cosign verify-blob lakka-v1.0.0-beta.1.tar.gz \
     --bundle lakka-v1.0.0-beta.1.tar.gz.sigstore.json \
     --certificate-identity 'https://github.com/lakka-ai/lakka/.github/workflows/release.yml@refs/tags/v1.0.0-beta.1' \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com
   

   sha256sum is shasum -a 256 on a Mac.

3. Unpack it and start it:

   tar -xzf lakka-v1.0.0-beta.1.tar.gz && cd lakka-v1.0.0-beta.1
   docker compose up -d --wait
   

4. Open http://localhost:8080 and follow the setup. The setup code comes from docker compose exec api lakka setup-code.

The guide covers the rest: serving it on a domain with HTTPS, administration, the API, every setting, backups, upgrades and troubleshooting.

What is in it

• Identity: local accounts and OIDC sign-in, workspaces, invites by link, and API keys that act as a person and can never do more than that person.
• Models: a gateway over Anthropic, OpenAI, Google and OpenAI-compatible providers, with failover before the first byte of a reply and cost recorded in integer micro-USD. An optional signed price feed, off by default, brings new prices between releases.
• Budgets: caps for the instance, each workspace, each member and each key, reserved before every request and refused when they cannot be checked; a per-person rate limit; alerts over signed webhooks.
• Routing: an in-process classifier picks a model by task, once per conversation, in English, German, French, Spanish and Swedish. It is optional everywhere, and a larger model can be chosen for other languages.
• Tools: MCP servers with per-person OAuth, allowlists, approvals and a full audit. Command-line servers run in a sandbox whose only network is an egress proxy.
• Operations: a trace for every request, opt-in content capture, retention, OTLP export, export and deletion of a person's data, a diagnostics bundle with no secrets in it, backup and restore, and rotation of the credential master key.
• No telemetry: nothing leaves the instance unless an admin turns that connection on.

Images

ghcr.io/lakka-ai/lakka:v1.0.0-beta.1 and ghcr.io/lakka-ai/lakka-caddy:v1.0.0-beta.1, for amd64 and arm64, signed keylessly with Sigstore and with build provenance attached. As a prerelease they are not tagged latest. The bundle names them by digest. To check one:

cosign verify ghcr.io/lakka-ai/lakka@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/lakka-ai/lakka/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limits

• Serving Lakka under a subpath, such as example.com/lakka/, is not supported, and neither is HTTPS with Caddy's internal certificates (tls internal).
• Under rootless Docker or userns-remap, the sandbox's users (uids 61000 to 61063) must be inside the mapped range; if they are not, the sandbox never becomes healthy. The troubleshooting guide says what to do.
• The OAuth callback for a tool server returns to the public URL, so reach the instance at that address, not another one such as 127.0.0.1 for localhost.
• The backup file is not encrypted and holds every secret, the credential master key included. Keep it as safe as the server.
• Attachments are stored in the database, so backups grow with them.
• Classification takes under 100 ms on 2 CPUs with the default model. The larger, optional model is held to 200 ms.

Upgrading

This is the first release, so there is nothing to upgrade from. Later releases upgrade in place, on the same volumes, as docs/guide/upgrade.md describes; the upgrade path from the previous release is tested on every change.

The configuration names, HTTP headers and API this release ships are meant to be the ones v1.0.0 ships. If one changes before then, the next release's notes say so.

License

AGPL-3.0-only. Contributions are signed off under the Developer Certificate of Origin, with no contributor license agreement; see CONTRIBUTING.md.